Proactive Forensics: Enabling the Last Access Timestamp

Defining Issues: Forensic Technology

The success of an investigation can depend on the steps taken before an incident occurs. Proactively setting computer functions, such as timestamps, to capture critical user activities is an important component of incident readiness.

This article introduces last access timestamps and explore the implications of disabling them.